skysight-inc/HackerNews huggingface dataset:
First of all, fb ad policy explicitly doesn’t allow selling fire arms.

https://m.facebook.com/policies/ads/prohibited_content/weapo...

If you are selling related stuff(belts, holster, vest, gun case etc), be prepared to have your fb ad account banned often(as the algo will likely (mis)-categorize you into selling weapons).

Advertisers in this space generally are very good at 1) cloaking, 2) renting or purchasing ad accounts.

both are against fb policy.

But in the end, as long as there is a positive ROI, and there is a way to circumventing the system, people will continue to do that. I don’t see how that’s fbs fault.
On most microwaves I encountered one can just press the start button and it will do just that: Start with a 30s countdown and pressing it again will add 30s.
If his net worth is $8 billion, he has enough to save his legacy?

Les Wexner got ousted from his company last year, but his name is still all over buildings in Columbus-- including various hospitals and universities. What will they be known for in even 5 years? Their likely ego/guilt driven charitable contributions or their associations with Epstein?
I met Pascal Hitzler on a few occasions, not long after he ended up relocating from Germany to Ohio to work at Wright State. He was a rare bright spot in always trying to bridge the gap between theory and application in the SemWeb community. He was kind enough to meet up with me and a colleague at a coffee shop in Dayton to discuss our project, all pro-bono. A real good dude.
How lucky to have been given access - been waiting since about November...
Not a chance. Cops and security don’t generally carry ar-15’s and those that do certainly are using locks. The site also doesn’t mention a single law enforcement client which is something they would be bragging about.

Maybe it’s because I’m a Texan but suburban dads are probably the largest gun owning demographic. Ive so many engineers show up to the range with a $4k ar-15 and shoot a couple hundred bucks in ammo. At least before covid shot prices through the roof.
I broadly agree about uncovered shorts.

That said, manipulating the price up because you think someone is manipulating it down, is still manipulating it. I'm not saying they're "the bad guy", but they're breaking the law and not actually helping anything imho.
Vacuum robot cleaner.

Man was I sceptic about these things and thought they were just marketing. I bought one a few months ago and it's an amazing piece of technology.
GameStop stock up 92.7% today
1) make a network request

2) track IP address
I don't necessarily disagree, and have no expertise on the subject. But skip to any part of this (excellent) documentary about a 'wethouse' (basically what you describe, a place for homeless
alcoholics to live, drink and socialise) and you'll see abject chaos, violence, misery at every turn. It's probably better than the streets, but not by much.

https://youtu.be/MF5wNsfKo84
Do you personally contribute to some random FOSS project? Usually these projects are big and it's just too much work up front to implement a tiny feature which you don't even know if it will be accepted upstream. I'd rather spend that time working on my own pet projects.

I happen to have a project that is fairly successful and all of the substantial contributions are from _big_ companies (think Google, Uber, Airbnb, etc) who have the cash to pay their employees for days or weeks of OSS contributions. Independent private/free-time contributors only make small changes despite the project being quite small.

A very interesting thing is that there is one contributor of my projects who appears to make a huge number of very simple pull-requests to a wide variety (literally hundreds) of projects. Things like fixing typos, dependency updates, and so on but I don't think he's a bot, so I have been wondering why he is doing this.
> I sincerely don't understand why "won" is in quotation marks – I think you meant to say "the popular vote isn't something that can be won since we have the electoral college" – and if that's the case, let me clarify that what I mean is that she received a significantly higher number of votes than Trump did.

Yes. It's like "winning" the first 100m of a 400m race. If the runners were in a 100m race, they would run differently.

> I don't understand the point you're making here.

The point is that there was a significant third-party vote in 2016, so it's not like Clinton had a particularly large vote share overall. The same vote share "lost" the popular vote in 2004, where third parties were less significant.

> Russian hacking was discussed prominently during the presidential debates in 2016, so I have to disagree with you on that point.

Of email servers. Not election systems.

> That may be true, but I haven't yet heard a good-faith argument for reforms (or in fact any argument for reforms) from people objecting to the 2020 election, nor any sense of what those reforms would be aside from things that could also be described as voter suppression

The fact that Democrats can describe something as "voter suppression" doesn't mean anything. Many things Democrats object to, such as Voter ID laws or signature matching, are prevalent in European countries. In Switzerland, mail-in voting has strict signature matching requirements. In Pennsylvania, it was the subject of a civil rights lawsuit. Mail in voting is, in general, discouraged in most of Europe. France had it, then abandoned it in the 1970s, due to voter fraud.

Other countries don't run elections like we do: with a flurry of last-minute lawsuits trying to chip away at any sort of rules or deadlines. That's not a healthy way to run an election system.
> But if sudo were written in Rust, it could have the same level of complexity and not be vulnerable

I'm puzzled that we don't have a memory-safe ABI (e.g. amd64-safe) and runtime for C so we could just compile things with

clang -safe sudo.c

to avoid memory errors. I'm fine with sudo (or whatever) taking a 60% performance hit to be more reliable - processors are thousands of times faster now than they were in 1980 when sudo was written. If we had a memory-safe ABI for C/C++ in common use its performance overhead could probably be reduced significantly over time due to implementation improvements, and we might see hardware acceleration for it as well.

There are a number of proof-of-concept memory-safe compilers for C using fat pointers, etc., but memory safety hasn't made it into gcc or clang. 64-bit CPUs can help because you can repurpose address bits. Even Pascal (which is largely isometric to C) supported a degree of memory safety via array bounds checking. I believe Ada compilers also support memory safety. PL/I was actually memory safe and is why Multics never had any buffer overflows. Obviously Rust is memory safe, but for a lot of legacy C code it is impractical to rewrite everything in Rust but eminently practical to recompile it with memory safety turned on.
It's +- 5% on accuracy, so not the best RTC, but it's fairly simple to give the internal RTC a better oscillator: https://user-images.githubusercontent.com/2858309/73125119-7...

Supposedly that makes it as good as typical cheap RTC modules.

Or, maybe +-5% is fine with just a few NTP updates now and again.

Edit: Apparently the built-in accuracy is substantially better if you avoid the deep sleep mode.
Perhaps the ads cannot discriminate between those that merely looked at washing machines, and those that actually bought one.
You have to keep in mind the time when these requirements to "use fax" for security came about.

There was a single telephone company (or it was shortly after there were plural "baby-bells") and the telephone network was a completely private, isolated, network that only the phone company (or baby-bells) even had access to. It was also a network that was heavily regulated such that the possibility of a random attacker from half a world away being able to tap into a phone call as it happened simply did not exist.

In that environment, placing a phone call was considered "secure" (or at least as secure as network isolation and regulation could cause it to become [I'm ignoring NSA style 'state secret' taps, those have likely always been available to NSA style agencies]). So it would have been seen, at that time, as reasonable to use fax machines for document exchange, because the "phone network" was considered to be secure against having a man-in-the-middle tapping off one's communications.

Wind the clock forward thirty years, and have the once isolated and highly regulated telephone network more or less become just another packet protocol on the general Internet, and the choice of using "fax" for secure document exchange sounds ludicrous.

The issue is that the regulations those environments operate under have not been updated in the ensuing thirty years to account for the fact that "phone network" is no longer the once isolated, mostly secure, network it once was. And if the regulations don't get updated, no lowly clerk at the front lines is going to lose their job by _not_ using the comm. system called for by the regulations.
As I'm not a K8s user take this with salt.

Heavily depends on your exact situation. Keeping your source code in git and let it build on a CI server was almost always enough for me. If your build server runs windows this is usually just fine.

C and C++ compilers on Linux have this IMHO very unpleasant property that the operating system wants to manage your development environment, so that the build output is a function not only of the repo, but also of things not under your control. I have little experience with that (I'm mostly a desktop developer, and these desktop applications are for windows), but so far simply not installing any -dev packages seems to have eliminate that problem. Put the library source code in the repo, use a git submodule, use a per repo package manager like nuget or cargo, whatever, just make sure your build input is in the repo and only there. For other programming languages this is generally not a issue. Thankfully no Linux distribution I'm aware of tried to sneak in their version of log4net, so far. Same seems true for every other languages I'm aware of, so this is a non-issue for any other language than C and C++.

Automated tests can run in a chroot to make sure all runtime requirements are contained in your build artefact. On Windows running them in a clean VM might be a good idea, but keeping the machine clean seems enough. Don't give people the password to that machine, so they are not tempted to "fix" problems by installing software there, fiddling with system settings, creating "magic" files, but by chaing the code in the repository.

I used repository singular, but this works for both monorepo and polyrepo.
I'm probably the only person reading this thread who owns a backhoe, and it's only a small one. There's really no material that will resist being dug through and is also practical to bury over miles and miles of fiber. There obviously are processes and measures in place to prevent "backhoe-fade" events, including armored cable, tracer wires and tape above the main cable but humans being humans things sometimes don't work out. Contractors can be liable for the cost to spice repairs which will be very costly so they're incented to not cut fibers.
While historically that has been somewhat true, 2020 saw an extreme rise in gun sales due to covid, mass protests, and tons of growth in both right and left wing militias.
> I would agree that that's more arguably a bug in libc than in doas, but also note that the startup code for any language has to consider this case.

This is true, but for a language where dynamically sized arrays are a standard data type, the most natural thing to do is to start by collecting the arguments into an array (maybe copying the strings at this point, maybe not). All further argument parsing is done with the array and is thus bounds-checked. I checked Rust's standard library and sure enough, it follows this pattern. Though, I could imagine some hypothetical startup code messing up the argc=0 case if it tried to separate argv[0] from the rest of the arguments while constructing the array.

> Anyway, I like your comment, but I'd recommend a different moral to this story: in the space of 47 minutes you were able to conduct a reasonably thorough audit on the doas codebase. Wanna give that a shot for sudo now?

Fair point. (And I didn't downvote you.) But in my opinion, that just confirms my view: ideally you want both simplicity and memory safety.
I’m not familiar with a distinct “sign in cookie” either. Do you mean a server side cookie / HttpOnly?
There's nothing to fix. The user agent string is a hot mess, but is only useful for server-side profiling, not client-side profiling. Client side, there are a million better ways to profile you, with the user agent string barely adding anything if worked in.
A lot of your statements are pretty strong, and imo totally incorrect.

> Complexity breeds bugs, including security bugs, and memory safety doesn't change that.

Yes, memory safety changes that radically.

> A simpler program will generally be more secure than a complicated one, no matter what language either is written in.

Disagree, but the statement is really weak anyways, especially since 'complexity' is an ill-defined term. More features? Cyclomatic?

> urthermore, rewriting an established program from one language to another will always introduce more bugs than it fixes, and more severely the more complex the program is.

Should be obvious to anyone that this isn't true.

> The single best way to improve security is to reduce the attack surface,

Not true, but it's a great way to start.
That's part of the dark outcome of so many untested features: it makes it easy to cast FUD upon any potential replacements. As we have no black-box test suite that shows `sudo` implements all of these features, so we also cannot have faith that any replacement would. Ideally it should be possible to run sudo's black box tests against any potential replacement. To start with, we need those tests.
So does this mean that a sock has ZERO holes, or HALF a hole? Because if you were to cut the sock to flatten it, your cut would only have to go from the top to the bottom of the sock, but not back up again - it's not a "complete cut."

Note: If you are having trouble visualizing this cut with a sock, replace it with a paper cone.
Born in 1891 in Hamilton, Ontario, and ordained in 1916 as a priest in the social justice–minded Basilian Order, Coughlin was sent in 1926 to the small parish of Royal Oak, Michigan, a predominantly Protestant suburb outside of Detroit.

Yes, this is true: https://en.wikipedia.org/wiki/Social_Justice_(periodical) https://en.wikipedia.org/wiki/National_Union_for_Social_Just...

The overlap in names between Coughlin's authoritarian-right movement and today's increasingly authoritarian-left version may at first seem like a mere coincidence, but my view is that this is reflective of a deep epistemological commonality between these views. Despite the surface-level political differences, which amounts to disagreement on who to scapegoat and which group should wield increasingly authoritarian power over others, they are not very different.

From where does this commonality stem? German philosophers, including Kant, Hegel and Marx (among many others) created the intellectual conditions within German society that made both the Weimar Republic and its collapse into Hitler's Nazi Germany inevitable, as documented in this book: https://www.penguinrandomhouse.com/books/530716/the-cause-of...
Maybe they could address the whole "there is a way to circumventing the system" thing? I mean, they own the system, so they should probably be responsible for any circumvention.
Deploy Portainer on MicroK8s in 5 minutes – easy container management UI for K8s
> People calling for an immediate 4% fine are ignoring that killing companies is bad for the economy.

As a person who calls for these, my reasoning isn't that they should dismantle the entire web because of it[0] - but that destroying a few small businesses and seriously hurting some big ones would set an example for all the rest to fall in line. Right now, companies seem to correctly reason that they're statistically unlikely to be noticed and fined.

--

[0] - Even though my belief is that advertising industry in particular is a social cancer and absolutely needs to be torched down to the ground.
> What could possibly be a more pressing concern than people's health?

"Health" is far more encompassing than "don't get the virus". I'm also talking mental health and security (food and shelter), both of which have been badly affected by the lockdowns and lost jobs from the lockdowns.

> obviously something went terribly wrong in the United States overall

There's (at least) two things going on here, neither of which has to do with the response:

* The US is big. Half the country has a different climate than the other half, and all evidence is that SARS-CoV-2 is heavily seasonal. What you're seeing in the country graph is as it recedes in one set of states, it grows in another set. Check out the curves for southern states like Florida, Mississipi, or Arizona - their first wave doesn't start until the summer, after first wave in the northern states like Illinois have already ended. Add them together and you get the consistently high rates for the whole country.

* Too-high-cycle PCR positives without symptoms being counted as a "case". The WHO just changed their recommendations last week because PCR testing has been being misused (as people have complained about since at least last summer) to take into account the false positives and symptoms; if these new recommendations are actually followed, expect the case rate to plummet pretty rapidly (though perhaps not sharply as different states may adopt it at different times).
Imagine a world where all our enemies DIDN'T know how fragile our infrastructure is. False security, surely, but still would be somewhat comforting. :)
Traders urging others to "hold the line" and to not sell is new marketing, and if everyone believes in it, why isn't it new phenomenon?

https://twitter.com/HenryEnglert/status/1353773947804917760/...
Seems like great content but on mobile at least the presentation is utterly unusable. I hope the author can make improvements
You are not the only person reading this thread who owns a backhoe.

Everything else is 100% correct!
Really? Going to der spiegel as someone from Chicago I get a "Continue reading with ads, Visit SPIEGEL.de as you normally would with the advertising and the usual tracking. (You can revoke your consent at any time.)" with an accept and continue box or "… or purchase a PUR subscription, It allows you to visit our site without any ad tracking and mostly free of advertising. €4.99/month, €1.99 for SPIEGEL+ subscribers".
>Disagree, but the statement is really weak anyways, especially since 'complexity' is an ill-defined term. More features? Cyclomatic?

I'm not sure of any definition of complexity you could appeal to which makes my argument weak.

>>rewriting an established program from one language to another will always introduce more bugs than it fixes, and more severely the more complex the program is.

>Should be obvious to anyone that this isn't true.

The opposite is painfully obvious: (1) Writing code causes bugs. (2) Rewriting an established project involves writing more code than leaving it would. (3) Writing all of that new code will introduce new bugs which were not present in the original.
> They are simply letting third party advertisers advertise.

I don't think it's quite that simple. Facebook controls the juxtaposition of ads with content, and with each other. This can reinforce the power of the individual ads, or attenuate it. In this case, it's pretty clearly creating a "caravan" of ads because that's more effective than letting each stand alone.

Disclaimer: I used to work at Facebook, but I was in storage. It gave me no particular insight into how the ad system works. This is just based on general knowledge of how human psychology and ML work.
I've heard of WET before, but I don't think that's the best "anti-DRY" phrase.

In the unit-testing world, they say "DAMP, not DRY". Descriptive and Meaningful Phrases, which happens to be repeating things a lot more than twice!

Some things are just clearer when repeated. Under such conditions, repeat yourself all the time (as long as it is clearer).

The question of DAMP vs DRY is eternal. Repetition is sometimes more clear, but sometimes is overly verbose and unclear. Its hard to know without experience.
This is an inaccurate view of HN. It has to be, because the people on the opposite side have an identical view, only with the high-order political bit flipped. That is, they're wrong in an exactly symmetrical way. Here's a taste—there are many more where these came from:

https://news.ycombinator.com/item?id=25427915

https://news.ycombinator.com/item?id=25615692

https://news.ycombinator.com/item?id=25779614

In reality, HN is divided on any topic that is divisive in society at large, including all the variations across the different countries represented here. That's a lot of variation.

Once you get over how both $X and anti-$X users pronounce HN to be an "echo chamber" (or "cesspool", an old favorite) controlled by their opponents, it's a bit of a puzzle how that is even possible. How can people come up with 100% opposite views of exactly the same thing?

I think these false feelings of generality are generated by the mind because the comments one dislikes make a much stronger (and more painful) impression on it than anything one likes or agrees with. The more one dislikes those, the more pain they cause, and the mind responds by creating an image, almost like an organ might secrete a membrane to protect itself. This explains both why these views are so identical (except for the high-order bit) and why they're most often posted by the people who have the strongest feelings for or against $X.

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...

Unfortunately this creates a situation where everyone with strong passions feels like the site is dominated by their enemies and they're basically surrounded by demons when they spend time here. That's not so good for community.

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...

In reality, HN is probably less hostile than similar places of comparable size on the internet. It's just that it's organized in a way that keeps everyone together, so you're much more likely to randomly bump into remarks that you passionately disagree with. On other sites people protect themselves from this by subscribing or following or connecting primarily with users of their own tribe, and come into contact with the other tribe only when going out on skirmishes. I wrote a mini-essay about that if anyone cares:

https://news.ycombinator.com/item?id=23308098
The only price tier that is worth it is the silver. The gold/ultimate is just way too expensive. It's a shame that the jump is so crazy for a team of 10, from paying 3K a year to paying over 14K a year.
If you want your SAST tool to be worth a damn you need to write your own rules, at a minimum configure sources and sinks manually especially in an app that has a lot of dependencies.

Last time I checked the security scanning tools that GitLab provides don’t really allow you to do that, SAST is expensive and also require manpower to manage well I guess if you only want to tick a box it might be worth it but I wouldn’t call the security features of GitLab worth the money you’re paying for especially with a large number of users.
Perhaps, but that mechanism doesn't need to persist in the browser across termination of execution.
Shell is in the middle of a restructure right now. From the top you can see many old Oil/Gas drilling/refining roles have been removed.

Shell appear to be becoming more of an energy trading / retail organisation, as they view fossil fuels are being commodities that they can trade for and sell at a higher price with their brand name.